CVE-2024-11986: Host Header Stored XSS Vulnerability

CVE-2024-11986 Overview

CVE-2024-11986 is a stored Cross-Site Scripting (XSS) vulnerability tied to improper input handling of the HTTP Host header in a web application. An unauthenticated remote attacker can inject a malicious payload that the application writes to its logs without sanitization. When an administrator later views those logs through the application's standard log-viewing functionality, the browser executes the attacker-controlled script. The referenced advisory points to CrushFTP, where the issue is addressed through vendor updates. The flaw is classified under CWE-79.

Critical Impact

Unauthenticated attackers can plant persistent XSS payloads that execute in an administrator's session, enabling session theft, privileged action abuse, and follow-on compromise of the management interface.

Affected Products

• CrushFTP (per CrushFTP Update Documentation)
• Web management and log-viewing components that render Host header values
• Administrator browser sessions viewing application logs

Discovery Timeline

• 2024-12-13 - CVE-2024-11986 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-11986

Vulnerability Analysis

The application accepts the HTTP Host header from inbound requests and writes its value into application logs without encoding or validation. Because logs are rendered in a browser through the built-in administrative log viewer, any HTML or JavaScript stored in the Host field is interpreted as active content at view time. This converts a passive logging surface into an active execution sink.

The attack is persistent. The payload remains in the log store until rotation or deletion, giving every administrator who opens the affected log entry an opportunity to trigger execution. The attack requires no authentication because HTTP servers accept and log requests from any source. User interaction is limited to an administrator viewing logs, an activity routine in operations.

The EPSS probability of 0.812% (74th percentile) reflects moderate near-term exploitation likelihood, while the issue itself is straightforward to weaponize.

Root Cause

The root cause is missing output encoding when log entries containing the Host header are rendered in an HTML context. Input sanitization on the request path is also absent, so attacker-controlled bytes survive intact from network ingress through to browser parsing.

Attack Vector

An attacker sends a single HTTP request to the exposed web service with a crafted Host header containing a script payload. The server logs the request. When an administrator opens the log view, the browser parses the stored payload as part of the page DOM and executes the script in the context of the administrative origin.

No verified public exploit code is available for CVE-2024-11986. The vulnerability mechanism is described in prose only; refer to the CrushFTP Update Documentation for vendor-supplied technical details.

Detection Methods for CVE-2024-11986

Indicators of Compromise

• HTTP request logs containing Host header values with <script>, onerror=, onload=, javascript:, or HTML entity-encoded equivalents.
• Inbound requests where the Host header does not match expected fully qualified domain names for the deployment.
• Outbound browser connections from administrator workstations to unfamiliar domains immediately after log viewing.
• Unexpected session token reuse or administrative actions originating from administrator accounts shortly after log access.

Detection Strategies

• Parse web server and application access logs for non-RFC-compliant or script-bearing Host header values.
• Alert on administrator log-viewer page loads correlated with anomalous JavaScript execution telemetry on the same endpoint.
• Use content security policy (CSP) violation reports as a signal that injected content attempted to load remote scripts.

Monitoring Recommendations

• Forward web server, application, and admin UI logs to a centralized analytics platform and apply regex rules for HTML tags inside header fields.
• Monitor administrator endpoints for browser process anomalies, suspicious child processes, and outbound connections to attacker-staged infrastructure.
• Track changes to administrator account permissions and session creation events that follow log-viewer activity.

How to Mitigate CVE-2024-11986

Immediate Actions Required

• Apply the vendor update referenced in the CrushFTP Update Documentation to the latest fixed release.
• Restrict access to the administrative web interface to trusted networks or VPN ranges until the patch is verified.
• Rotate administrator credentials and active session tokens if any unexplained log entries with HTML content are present.
• Purge or archive log files that contain suspicious Host header payloads after forensic review.

Patch Information

Follow the vendor upgrade procedure documented at CrushFTP Update Documentation. Confirm the running build version after upgrade and re-test the log viewer with a benign Host header payload such as <test-marker> to validate that output encoding is enforced.

Workarounds

• Place the web service behind a reverse proxy that validates Host header values against an allowlist and rejects requests with malformed or script-laden headers.
• Enforce a strict Content-Security-Policy on the administrative UI to block inline script execution and remote script loading.
• Limit administrator log-viewing to a hardened jump host with no access to sensitive resources, reducing impact if a payload executes.
• Use a text-based log viewer outside the application UI for routine log review until the patched version is deployed.

# Example reverse proxy Host header allowlist (nginx)
map $http_host $host_ok {
    default                 0;
    "ftp.example.com"       1;
    "ftp.example.com:443"   1;
}

server {
    listen 443 ssl;
    if ($host_ok = 0) { return 400; }
    location / { proxy_pass http://crushftp_backend; }
}